search

k4m4 / kickthemout

💤 Kick devices off your network by performing an ARP Spoof attack.
https://nikolaskama.me/kickthemoutproject
MIT License
2.52k stars 440 forks source link

Problems with scanning alive hosts #244

Closed meichengg closed 6 years ago

meichengg commented 6 years ago

I scanned myself using nmap and found my Apple device was up, but i used kickthemout it didn't show my Apple IP, so i think there's a problem with the scanning, please have a check

k4m4 commented 6 years ago

Hi there @huyndnse63331. KickThemOut uses a regular nmap -sP scan to identify online devices. Could you please upload a PoC screenshot? Thanks!

meichengg commented 6 years ago

sorry for my late response, here i used kickthemout firstly, it gave me this

1

weird that im having 3-4 devices connected to the wifi, so i decided to use nmap to check

a

but i can't see my Apple device :|

tp

k4m4 commented 6 years ago

Hey @huyndnse63331. Thanks for bringing it up; I was actually able to reproduce this and it seems that it's a bug. Nmap doesn't seem to be detecting all alive hosts. I will look into it asap.

meichengg commented 6 years ago

thanks guys, let me know when the problem is fixed <3

meichengg commented 6 years ago

any progress guys?

k4m4 commented 6 years ago

Hey there again @huyndnse63331. We are about to release a new version of KickThemOut with several changes. It should be coming out soon, so please be patient. :) Thanks!

k4m4 commented 6 years ago

Hi @huyndnse63331. Can you reproduce this with v2.0?

meichengg commented 6 years ago

hi im testing it, will let you know in a few moments

meichengg commented 6 years ago

the bug is still present https://medium.com/@thereallulz/bug-kickthemout-v2-0-42c0b475da5f

xdavidhu commented 6 years ago

@huyndnse63331 @k4m4 I have tested how Apple/Android mobile devices behave on WiFi, and they are rarely responding to ARP requests because of battery saving reasons.

So they are not constantly (actively) connected to the WiFI, only if the device wants to connect to somewhere or load something. Then they connect back and if they see an ARP request they respond to it like others. But after these mobile devices are done with their stuff they turn their radios into power saving mode (or something similar) and not really care about whats going on in the network.

So all in all this is not a bug with nmap or KickThemOut, the only way to detect these devices is to run multiple scans until they show up, or run nmap/KickThemOut when they are actively using the network. (e.g watching a YouTube video)

meichengg commented 6 years ago

@xdavidhu , hi sorry for my late response, u mentioned "run multiple scans", so does kickthemout support multi scans?

k4m4 commented 6 years ago

Hi @huyndnse63331. By multiple scans, David means scanning your network repeatedly until your device shows up. There's really nothing more you/we can do. If you know the IP address of your device, you can try spoofing it by using KickThemOut's new argument based attack feature (for more info run sudo python3 kickthemout.py -h). Thanks!

k4m4 commented 6 years ago

Closing due to inactivity; assuming that the issue has been solved. If you are still experiencing a problem, please re-open this issue. Thanks!